improvements to st and clearnet sections

Author: MattDHill

src/misc-guides/start-tunnel.md

@@ -2,9 +2,9 @@
 
 ## Installation
 
-Follow the [official instructions](https://github.com/Start9Labs/start-os/blob/next/major/START-TUNNEL.md) to install StartTunnel on a VPS.
+Follow the [official StartTunnel instructions](https://github.com/Start9Labs/start-os/blob/next/major/START-TUNNEL.md) to install StartTunnel on a VPS.
 
-The instructions below assume you chose to initialize the web interface. If not, you can do everything using the start-tunnel CLI.
+The instructions below assume you chose to initialize the StartTunnel web interface. If not, you can do everything using the start-tunnel CLI.
 
 ## Adding your StartOS Server
 
@@ -14,14 +14,14 @@ The instructions below assume you chose to initialize the web interface. If not,
 
     - Give your server a name (e.g. "Start9 Server").
     - Select a subnet (the default subnet, `10.59.0.1/24`, is fine).
-    - Accept/Choose what IP address your server will have on the a LAN.
+    - Accept/choose what IP address your server will have on the a LAN.
     - Click "Save".
 
 1.  Download the resulting `start-tunnel.conf`, (or copy to your clipboard).
 
 1.  In StartOS, navigate to `System -> Gateways` and click "Add".
 
-1.  Give the gateway a name (e.g. "StartTunnel").
+1.  Give the gateway a name (e.g. "StartTunnel 1").
 
 1.  Upload `start-tunnel.conf` (or paste from your clipboard).
 
@@ -55,7 +55,7 @@ In order to expose a service interface to the public Internet, it is necessary t
 
 1. Under `Addresses`, find the `Public` address you want to expose. A domain is usually best, but it is also possible to expose `IP:port`.
 
-1. Click the "ⓘ" icon.
+1. Click the blue "ⓘ" icon.
 
 1. Find the line that says "Requires port forwarding in gateway..." and take note of the `:externalPort -> IP:internalPort`.
 

src/user-manual/connecting-remotely/clearnet.md

@@ -29,6 +29,8 @@ With few exceptions, you should add a domain to your service interface so that y
 
    ```admonish warning
    If you select your server's Root CA, only devices that have downloaded and trusted your server's Root CA will be able to access the domain without issue.
+
+   If you want other devices to reach this domain without issue, you should select Let's Encrypt from the dropdown. To add Let's Encrypt to your list of available Certificate Authorities, follow the [instructions](../authorities.md).
    ```
 
 1. Click "Save".

src/user-manual/connecting-remotely/vpn.md

@@ -23,9 +23,15 @@ Most modern routers include a VPN server feature. If so, it is usually the prefe
 
 ## Option 2: StartTunnel
 
-There are two reasons to select this option: (1) your router does not offer a VPN server or (2) you are already using StartTunnel for [clearnet](./clearnet.md) hosting, so most of the work is already done.
+By default, StartTunnel exports wireguard config files that are configured for split tunneling, allowing you to use your StartTunnel VPN to access your StartOS server and installed services while also preventing it from being automatically used for all Internet traffic.
 
-See [Creating a StartTunnel Private Gateway](../../misc-guides/start-tunnel.md).
+There are three reasons to select this option:
+
+1. Your router does not offer a VPN server.
+2. Your router's VPN server is not automatically configured for split tunneling.
+3. You are already using StartTunnel for clearnet hosting, so most of the work is already done.
+
+To use StartTunnel for private, remote VPN access, see [Creating a StartTunnel Private Gateway](../../misc-guides/start-tunnel.md), including the section for [Adding a Client Device for Private Access](../../misc-guides/start-tunnel.md#adding-a-client-device-for-private-access)
 
 ## Connecting Clients